The Cisco ASA must be configured to implement scanning threat detection.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239864	CASA-FW-000220	SV-239864r891328_rule		High

Description
In a port scanning attack, an unauthorized application is used to scan the host devices for available services and open ports for subsequent use in an attack. This type of scanning can be used as a DoS attack when the probing packets are sent excessively.

STIG	Date
Cisco ASA Firewall Security Technical Implementation Guide	2023-02-13

Details

Check Text ( C-43097r891327_chk )
NOTE: When operating the ASA in multi-context mode with a separate IDPS, threat detection cannot be enabled and this check is Not Applicable. Review the ASA configuration to determine if scanning threat detection has been enabled. threat-detection scanning-threat shun NOTE: The parameter "shun" is an optional parameter in the Cisco documentation, but is required here to offer additional protection by dropping further connections from the threat. If the ASA has not been configured to enable scanning threat detection, this is a finding.

Check Text ( C-43097r891327_chk )

NOTE: When operating the ASA in multi-context mode with a separate IDPS, threat detection cannot be enabled and this check is Not Applicable.

Review the ASA configuration to determine if scanning threat detection has been enabled.

threat-detection scanning-threat shun

NOTE: The parameter "shun" is an optional parameter in the Cisco documentation, but is required here to offer additional protection by dropping further connections from the threat.

If the ASA has not been configured to enable scanning threat detection, this is a finding.

Fix Text (F-43056r665877_fix)
Configure scanning threat detection as shown in the example below. ASA(config)# threat-detection scanning-threat shun